Описание
MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4.
Ссылки
- Issue TrackingPatch
- Issue TrackingPatch
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.29.4 (исключая)
cpe:2.3:a:ml-explore:mlx:*:*:*:*:*:*:*:*
EPSS
Процентиль: 27%
0.00095
Низкий
9.1 Critical
CVSS3
Дефекты
CWE-122
Связанные уязвимости
CVSS3: 6.5
redhat
5 месяцев назад
MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4.
EPSS
Процентиль: 27%
0.00095
Низкий
9.1 Critical
CVSS3
Дефекты
CWE-122